Privacy Policy

Many tools run entirely in your browser. For these, your file is never uploaded: the page converts it on your own device and it never reaches our servers. They are:

• converting images: BMP, GIF, JPG, PNG, SVG and WebP saved as JPG, PNG or WebP;
• converting data files between CSV, INI, JSON, JSON5, NDJSON, TOML, TSV, XML and YAML;
• converting subtitles between SBV, SRT and VTT;
• converting HTML to Markdown and Markdown to HTML;
• these PDF tools: Merge PDF, Split PDF, Rotate PDF, Add Page Numbers, Watermark PDF, Organize PDF, Crop PDF, Sign PDF, Redact PDF, Add Text to PDF, N-up PDF, Fill PDF Form, Flatten PDF and Compare PDF;
• compressing an image to a target size.

In the converter, those conversions show an "In your browser" indicator.

Other tools (video, audio, transcription, OCR, RAW photos, HEIC, TIFF and AVIF images, office documents, ebooks and similar, plus the PDF tools Compress PDF, Protect PDF, Unlock PDF, Repair PDF, PDF to PDF/A, OCR PDF, PDF to Images and Extract Images) need a heavier engine. For these, the file is uploaded over an encrypted connection to our private storage, which Supabase provides, converted by our own engine on our own machines, and the result is made available to you. No outside conversion service is involved. We process your file only to perform the conversion you requested. We do not read, analyse, sell, or use your files to train AI.

Any uploaded files and converted outputs are automatically deleted after 1 hour. Download links expire on the same timeframe. Keep your own copy of anything you need.

You don't need an account to convert files. If you sign in (for admin or paid features), we store your email address and account settings. That's it.

Like any web service, we process limited technical data: IP address, browser type, and request timing, to operate the service, prevent abuse, and apply rate limits. We keep these logs only as long as needed for security and reliability.

Paid plans are handled by Stripe. We never see or store your full card number. Stripe processes payments and returns only a confirmation and limited metadata (such as the last four digits and plan status).

We do not sell your personal information. We use a small set of sub-processors:

• Supabase: stores the files you upload and the converted results, encrypted, until they are deleted, and holds the account database.
• Stripe: processes payments for paid plans.
• Resend: sends account and billing emails, and job emails you ask for.
• Lovable and Cloudflare: host and serve the website; Lovable records page performance and engagement events.
• Google: provides the Sign in with Google button on the sign-in page, and receives your sign-in only if you use it.
• TranscriptAI: only when you choose to send a converted file to it.

FileWhirl can hand a converted audio or video file to TranscriptAI for transcription and notes. This only happens when you click "Send to TranscriptAI". Once a file is in TranscriptAI, TranscriptAI's own privacy policy applies.

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, or delete your personal data, and to object to certain processing. Because conversion files auto-delete after 1 hour, most data is short-lived by design. To exercise any right, email admin@transcriptai.io.

In-browser tools never send your file over the network at all, so there is nothing to intercept. For conversions that do upload, files use TLS in transit and are stored encrypted at rest. Short retention is our main privacy safeguard: the less we keep, the less is ever at risk.

FileWhirl is not directed at children under 16, and we do not knowingly collect their data.

We may update this policy as the product evolves. Material changes will be reflected by the "last updated" date above.